Chapter 11: Dynamic Analysis

Omar Meqdadi

SE 3860 Lecture 11Department of Computer Science and Software Engineering

University of Wisconsin-Platteville

2

Topic Covered

Why Dynamic Analysis Control Flow Trace Dynamic Dependence Graph Dynamic Backward Slicing

3

Dynamic Analysis

Dynamic analysis : dynamic representations of the code determine a flow through a software system given a

particular set of inputs or a user scenario(s). Part of the impact analysis of required change Why

Help maintainer gain initial understanding of a software system

Diagnose and/or localize problems. Static analysis is very imprecise

Example: Debugger

Dynamic Analysis

Dynamic program representations Control Flow Trace Dynamic Dependence Graph

Control Flow Trace

List of all the execution points (execution paths) given a particular program point (input)

Flow chart when executing a given input Format :

<… xi, …> , where xi is an execution point

Steps: Draw the flow chart Find the execution given a particular input

Control Flow Trace: Example

3: while ( i<N) do

1: sum=02: i=1

4: i=i+15: sum=sum+i

6: print (sum)

11: sum=0

31: while ( i<N) do

51: sum=sum+i32: while ( i<N) do 42: i=i+1

33: while ( i<N) do 61: print (sum)

N=3:

21: i=1

41: i=i+1

52: sum=sum+i

Flow Chart Control Flow Trace at N=3

N = 3 : < 11, 21, 31, 41, 51, 32, 42, 52, 33, 61 >

Dynamic Dependence Graph

Dynamic Dependency Graph (DDG) : A PDG ( see Chapter 10) assuming fixed input for the

program Reconsider the following code

from Chapter 10 and assume

X( from statement S1) = -1:

DDG Example

PDG DDG at X = -1

Dynamic Backward Slicing

Recall that program slice is a subset of a program that contains the relevant code to the computation of interest, see Chapter 10.

Dynamic Slicing assumes fixed input for a program A dynamic backward slice query is S < V , I , N >

The set of statements involved in computing variable V’s value at statement N assuming that I is the input for the program

Advantages : Smaller More precise More helpful to the user

Dynamic Backward Slicing

Two Approaches: Considering only the data dependency (Minimal Slicing)

Using Dynamic Data Dependency Graph Considering both data and control dependencies

Using Dynamic Dependency Graph

1: b=02: a=23: for i= 1 to N do4: if ((i++)%2==1) then5: a = a+1 else6: b = a*2 endif done7: z = a+b8: print(z)

S < z , N=2, 8 >11: b=0 [b=0]

21: a=2

31: for i = 1 to N do [i=1]

41: if ( (i++) %2 == 1) then [i=1]

51: a=a+1 [a=3]

32: for i=1 to N do [i=2]

42: if ( i%2 == 1) then [i=2]

61: b=a*2 [b=6]

71: z=a+b [z=9]

81: print(z) [z=9]

Dynamic Backward Slicing Approch1:

Dynamic Backward Slicing Approach2

Using DDG: A dynamic program slice is identified from a DDG as follows:

for a variable V at node N, identify all reaching definitions of V.

find all nodes in the DDG which are reachable from those nodes.

The visited nodes in the traversal process constitute the desired slice.

Consider the program in the slide 7 and variable Y at S10. Therefore, with respect to variable Y at S10, the dynamic slice will

contain only {S1, S2 and S3}. So: For −1 as the values of X, if the value of Y is incorrect at S10,

one can infer that either erroneous at S3 or the “if” condition at S2 is incorrect.